# Logstash couldn't connect to to elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-couldnt-connect-to-to-elasticsearch/182193>\
**Category:** Logstash\
**Created:** [May 22, 2019, 9:57am UTC](https://discuss.elastic.co/t/logstash-couldnt-connect-to-to-elasticsearch/182193 "2019-05-22T09:57:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![85acb6d03dd51a41bbc7](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/85acb6d03dd51a41bbc7/32/45364_2.png) [@85acb6d03dd51a41bbc7](https://discuss.elastic.co/u/85acb6d03dd51a41bbc7)\
**Post date:** [May 22, 2019, 9:57am UTC](https://discuss.elastic.co/t/logstash-couldnt-connect-to-to-elasticsearch/182193/1 "2019-05-22T09:57:59Z")

</div>

Hi guys,  
I'm configured ELK stack.  
ElasticSearch in ubuntu server 18.04  
Kibana in docker  
Logstash in docker  
FileBeat in web-server (IIS)

Logstash don't adding data in elasticsearch. If i'm install logstash on windows it working. (logstash.conf same) logstash.yaml is default.  
Logstash container is see elasticsearch

Docker run:

`docker run --rm -p 5000:5000 -p 5000:5000/udp -p 5044:5044 -p 9600:9600 -v /opt/logstash/config/logstash.conf:/config/logstash.conf -v /opt/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml --name logstash logstash:7.0.1`

Logstash.config:

```
input {
	beats {
        port => 5044
		client_inactivity_timeout => 200
		#ssl => true
		#ssl_certificate => "C:\Temp\cert\logstash-forwarder.crt"
		#ssl_key => "C:\Temp\cert\logstash-forwarder.key"
    }
}

filter {

	if [fields][log_type] == "iis" {
		grok {
			match => { "message" => "%{TIMESTAMP_ISO8601:ts} %{IPORHOST:client} %{WORD:method} %{URIPATHPARAM:request_path} %{GREEDYDATA:uri_param} %{NUMBER:port:int} %{GREEDYDATA:user} %{IPORHOST:user_ip} %{GREEDYDATA:user_agent} %{GREEDYDATA:referer} %{NUMBER:response_status:int} %{NUMBER:substatus:int} %{NUMBER:win32_status:int} %{NUMBER:ellapsed_milliseconds:int}" }
		}

	    date {
			match => ["ts", "yyyy-MM-dd HH:mm:ss"]
			target => "event_ts"
		}
		
		geoip {
			source => "user_ip"
		}
	}
	
	if [fields][log_type] == "httperr" {
		grok {
			match => { "message" => "%{TIMESTAMP_ISO8601:ts} %{IPORHOST:c_ip} %{NUMBER:c_port:int} %{IPORHOST:s_ip} %{NUMBER:s_port:int} %{GREEDYDATA:cs_version} %{GREEDYDATA:cs_method} %{GREEDYDATA:cs_uri} %{GREEDYDATA:sc_status} %{GREEDYDATA:siteid} %{GREEDYDATA:reason} %{GREEDYDATA:queuename}" }
		}

		date {
			match => ["ts", "yyyy-MM-dd HH:mm:ss"]
			target => "event_ts"
		}
		
		geoip {
			source => "c_ip"
		}
	}
}

output {
	elasticsearch {
		hosts => ["192.168.1.16:9200"]
		index => "iis-%{[fields][log_type]}-%{+YYYY.MM.ww}"
	}
}

```

Input logstash container log:

{  
"@version" =\> "1",  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied"  
],  
"source" =\> "C:\Windows\System32\LogFiles\HTTPERR\httperr1.log",  
"beat" =\> {  
"name" =\> "v-titov",  
"hostname" =\> "v-titov",  
"version" =\> "6.2.1"  
},  
"message" =\> "2019-05-22 08:10:53 192.168.1.149 48906 192.168.1.72 5357 - - - - - - Timer\_ConnectionIdle -",  
"fields" =\> {  
"server" =\> "mm",  
"log\_type" =\> "httperr"  
},  
"@timestamp" =\> 2019-05-22T08:12:03.207Z,  
"prospector" =\> {  
"type" =\> "log"  
},  
"offset" =\> 1818  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2019, 9:58am UTC](https://discuss.elastic.co/t/logstash-couldnt-connect-to-to-elasticsearch/182193/2 "2019-06-19T09:58:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.